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(57) Abstract 

An integrated circuit accesses first encrypted data stored in an external random access memory and accesses second encrypted data 
stored in an extemal read-only memory. The external random access memory and the external read-only memory are extemaJ to the 
integrated circuit. When accessing a first portion of the first encrypted data stored in the extemal random access memory, a first algorithm 
is used to decrypt the first portion of the first encrypted data^ When accessing a first portion of the second encrypted data stored in the 
external read-only memory, a second algorithm is used to decrypt the first portion of ttie second encrypted data. The second algorithm is 
different than the first algorithm. 
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SECURE MEMORY MANAGEMENT UNIT WHICH USES MULTIPLE 
CRYPTOGRAPHIC ALGORITHMS 

TECHNICAL FIELD 
The present invention concerns memory management in a computer 
system designs and pertains particularly to a secure memory management 
unit which uses multiple cryptographic algorithms. 

BACKGROUND 

In order to protect against theft or misuse, secure information within 
a computing system can be encrypted before being. stored in the memory for 
the computing system. When a secure integrated circuit uses the secure 
information, the secure information is transferred to the integrated circuit 
and decrypted before being used. Sec\ire information returned to the 
memory for the computing system is encrypted before being stored. 

Typically, decr3rption and encryption is handled by a secure memory 
management unit (SMMU) on the integrated circuit. When a processor 
requires the use of a page of secure information, the secinre memory 
management vmit on the integrated circuit obtains the page of secure 
information, decrypts the page of sectire information and places the data in 
a cache memory for access by the processor. The cache is ts^pically 
implemented using static random access memory (SRAM). 

If, in order to bring in the page of secure information, a "dirty" page of 
information needs to be swapped out to memory, the SMMU performs the 
swap out of the "dirty" page of information before the new page is placed in 
the cache. A "dirty" page of information is a page of information which has 
been written to while in the cache where the changes made have not been 
written out to the system memory. If the "dirty" page of information 
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contains secure information, the SMMU first encrypts the page before 
swapping the page out to system memory. While performing page swapping 
the SMMU holds off the processor while pages are being swapped to and 
firom the processor cache. 

The SMMU handles all sectire information for a computing system. 
The secure information can include both executable code (t3rpically stored in 
a read-only memory (ROM)} and data (typically stored in random access 
memory (RAM)). 
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SUMMARY OF THE INVENTION 
In accordance with the preferred embodiment of the present 
invention, an integrated circuit accesses first encrypted data stored in an 
external random access memory and accesses second encrypted data stored 
5 in ein external read-only memory. The external random access memory and 
the external read-only memory are extemsJ to the integrated circuit. When 
accessing a first portion of the first encrypted data stored in the external 
random access memory, a first algorithm is used to decrypt the first portion 
of the first encrypted data. When accessing a first portion of the second 
10 encr3^ted data stored in the external read-only memory, a second algorithm 
is used to decrypt the first portion of the second encrypted data. The second 
algorithm is different than the first algorithm. 

For example, the first portion of the second encrjrpted data includes 
instructions for execution by a processor and the first portion of the first 
1 5 encrypted data includes data used during execution by the processor. When 
returning the first portion of the first encr3rpted data to the external random 
access memory, the first algorithm is xised to encrypt the first portion of the 
first encr3rpted data. 

In the preferred embodiment, in order to provide extra protection, a 
20 new decryption key for the first algorithm is generated upon start-up and 
upon reset of the integrated circuit. 

The present invention allows for an increase in security. In addition, 
the use of different algorithms allows a highly secure algorithm to be used 
for information which is only to be decrypted and a less secure algorithm for 
25 data which will be encrypted and decrypted. One reason the less secin-e 
algorithm does not need to be as strong as the highly seciu-e algorithm is 
because the data encrypted by the less secure algorithm does not remain 
encrypted for as long a period of time as data encrypted by the highly secure 
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algorithm. In this way security may be provided while at the same time 
providing greater flexibihty in designing parts which conform to various 
export laws which forbid export of parts with certain encryption capability. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 is a simplified block diagram illustrating different 
cryptographic algorithms being used on information dependent upon 
whether the information is an instruction stored in ROM or data stored in 
RAM in accordance with the preferred embodiment of the present invention. 

Figure 2 is a simplified block diagram of an integrated circuit which 
includes a secure memory management imit in accordance with the 
preferred embodiment of the present invention. 

Figure 3 is a simplified block diagram of the secure memory 
management xmit shown in Figure 2 in accordance with the preferred 
embodiment of the present invention. 

Figure 4 is a simplified block diagram which shows data flow of 
secure information from an external system memory into cache memory 
within the integrated circuit shown in Figure 2 in accordance with the 
preferred embodiment of the present invention. 

Figure 5 illustrates usage of registers within the secure memory 
management imit shown in Figiire 3 in accordance with the preferred 
embodiment of the present invention. 

Figure 6 is a simplified block diagram which illustrates data flow for 
a data miss within the integrated circuit shown in Figure 2 in accordance 
with the preferred embodiment of the present invention. 
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DISCLOSURE OF THE INVENTION 
Figure 1 is a simplified block diagram illustrating different 
cryptographic algorithms, within a single secure memory management 
unit (SMMU) 13, being used on information dependent upon whether the 
5 information is an instruction stored in an external read-only memory 

(ROM) 145 or data stored in an external remdom access memory (RAM) 45. 
Any type of SMMU system implemented in either hardware or software can 
be used to implement SMMU 13. 

For secure instructions (or other secure data) stored in external ROM 

10 145, a decrjrption algorithm 94 is used for decryption before placing the 

information in a section of memory reserved as ROM secure information 92. 
For secure data stored in external RAM 45, an encrs^tion/decryption 
algorithm 93 is used for decrjrption before placing the information in a 
section of memory reserved as ROM secure information 92, and is used for 

15 encryption before returning the information back into external RAM 45. 

Encryption/decryption algorithm 93 can be made more secure by 
randomly generating, after each reset of SMMU 13, a unique reset key used 
in encryption/decryption algorithm 93. This separate reset key is then used 
to encrypt/decrjrpt RAM secure information 91 passing through SMMU 13. 

20 Generating a xmique key for each reset of SMMU increases the security of 
the SMMU 13 by reducing the length of time SMMU 13 woxild be 
compromised if the key was discovered. The imique key generated for 
encryption/decryption algorithm 93 is a different key than the key used for 
decryption algorithm 94. Thus, for SMMU 13 it would be necessary to 

25 discover two secure keys (the xmique key generated for encryption/decryption 
algorithm 93 and the separate secure key used for decrjrption algorithm 94) 
in order to compromise the security of SMMU 13. 
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In the preferred embodiment, encrs^Dtion/decrjrption algorithm 93 
and decryption algorithm 94 operate in accordance with the Data Encryption 
Standard CDES). See for example. Data Encryption Standard (DES)y Federal 
Information Processing Standards Publication (FIPS PUB) 91-2, December 
5 30, 1993 available from the U.S. Department of Commerce, Technology 

Administration, National Institute of Standards and Technology. See also 
DES Modes of Operation, Federal Information Processing Standards 
PubUcation (FIPS PUB) 81, December 2, 1980 available from the U.S. 
Department of Commerce, National Bureau of Standards. Alternatively, 

10 some other encryption/decryption algorithm may be used. 

Decryption algorithm 94 is, for example, a 56-bit 3 DES algorithm 
which uses a 56-bit secure key. Encryption/decryption algorithm 93 is, for 
example, a 40-bit 1 DES algorithm which uses a 40-bit secure key. Becaxise 
encrsnption is only performed using the 40-bit 1 DES algorithm, maximum 

15 performance is obtained while still providing significant protection for ROM 
secure information 92 and RAM secure information 91. 

The two algorithm system may be variously integrated into processor 
systems which utilize a secure memory management unit (SMMU). 

For example, Figure 2 is a simplified block diagram of an integrated 

20 circuit which includes a system processor 12, a soft secure memory 
management unit (SMMU) 13, and main memory 14 connected to a 
processor bus 11. For example, processor 11 is an ARM7TDMI processor or 
another processor that may be included on an integrated circuit. Main 
memory 14 is, for example, implemented as a static rsindom access memory 

25 (SRAM). A hardware encrjrption core 16 may be included. Alternatively, 
encrjrption/decryption may be performed by system processor 12. For 
example, encryption and decryption is performed in accordance with the 
Data EncrjTJtion Standard (DES). 
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Soft SMMU 13 takes advantage of system processor 12 to handle page 
allocation and data movement for page updates. Ftmctionality of soft SMMU 
13 is reduced to maintaining page information and triggering an abort of the 
memory cycle on a page miss. System processor 12 can interrupt the abort 
5 as a page miss and update the page registers in the soft SMMU 13. The new 
page can then be loaded and decrypted by system processor 12. This allows 
great flexibility in the determination of multiple pages, write back capability, 
or locking pages that are used often. As mentioned above, hardware 
encryption core 16 is not required for low end appUcations or for simple 
10 encryption methods. For these case an encryption/decrjrption algorithm can 
be resident on system processor 12. 

In the preferred embodiment, the hardware within soft SMMU 13 is 
page modular. The timing requirements are greatly reduced since soft 
SMMU 13 only compares an address received on an external bus to the page 
15 boundaries in the page registers within soft SMMU 13, Soft SMMU 13 can 
abort the cycle at the end of the memory transaction, therefore soft SMMU 13 
does not have to make a comparison at the beginning of the cycle. Since data 
. is moved by system processor 12, there are no special DMA ports or DMA 
blisses that are necessary. System processor 13 can move the data on the 
20 memory bus 11. 

The data pages that are cached by system processor 12 can be stored as 
pages 15 in main memory 14, which serves as scratch memory space for 
processor 12. Instructions that are cached by system processor 12 can be 
stored as pages 115 in main memory 14. Alternatively, the instructions can 
25 be stored in a separate instruction cache. Soft SMMU 13 is a simple 
peripheral attached to processor bus 11. 

Soft SMMU 13 monitors address requested by system processor 12 for 
an instruction or data operation that is within the page limits of secure 
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information stored in an external system memory (either external RAM 45 
or external ROM 145). The external system memory is external to the 
integrated circuit- Limit registers within soft SMMU 13 indicate the page 
limits of secure information stored in the external system memory. If the 
5 data requested by system processor 12 is within the page Umits of secxire 
information stored in the external system memory but is not located on a 
page that is currently held in main memory 14, soft SMMU 13 will abort the 
operation using an abort line 17. 

Figure 3 is a simplified block diagram of soft SMMU 13. Limit 

10 registers 22 store page limits for secure information within an external 

system memory external to the integrated circuit. A comparison circuit 23 
compares the page limits in limit registers 22 with an address on address 
lines 21 of processor bus 11. When the address on address lines 21 is within 
the page limits in limit registers 22, a WITHIN flag on a line 33 is asserted 

15 true. 

Registers 24 contain information (e^g,, start address and page size) of 
a "page 0" of data stored in pages 15 of main memory 14. A comparison 
circuit 25 compares the information in registers 24 with the address on 
address lines 21 of processor bus 11 to determine whether the address on 
20 address lines 21 addresses data stored ia "page 0" of data stored in pages 15 
of main memory 14. When the address on address lines 21 addresses data 
stored in "page 0" of data stored in pages 15, an "EQO" flag on a line 30 is 
asserted true 

Registers 26 contain information (e.g., start address and page size) of 
25 a "page 1" of data stored in pages 15 of main memory 14. A comparison 
circuit 27 compares the information in registers 26 with the address on 
address lines 21 of processor bus 11 to determine whether the address on 
address lines 21 addresses data stored in "page 1" of data stored in pages 15 
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of main memory 14. When the address on address hnes 21 addresses data 
stored in "page 1" of data stored in pages 15, an "EQl" flag on a line 31 is 
asserted true. 

For every page in pages 15 and pages 115, soft SMMU 13 contains 
5 similar circuitry. For example, registers 28 contain information (e.g., start 
address and page size) of a "page N" of data stored in pages 15 of main 
memory 14. A comparison circuit 29 compares the information in registers 
28 with the address on address lines 21 of processor bus 11 to determine 
whether the address on address Unas 21 addresses data stored in "page N" of 
10 data stored in pages 15 of main memory 14. When the address on address 
lines 21 addresses data stored in "page N" of data stored in pages 15, an 
"EQN" flag on a Une 32 is asserted true. 

Limit registers 22 and registers 24, 26 and 28 can be accessed by 
processor 12. This allows for great flexibiHty in configuring the external 
1 5 memory, main memory 14 and the page size of individual pages. 

For a page access, soft SMMU 13 determines there is a HIT when the 
address on address lines 21 results in, for a page X, the EQ flag being 
asserted (EQX) and the page being enabled (ENABLEX). Thus there is a 
HIT on page 0 for EQO AND ENABLEO. There is a HIT on page 1 for EQl 
20 AND ENABLEl. There is a KPT on page N for EQN AND ENABUEN, 

The address on address lines 21 is used to access a value within pages 
15 or pages 115 of main memory 14, when there is a fetch command and the 
address on address lines 21 results in a HIT and the WITHIN flag on a line 
33 is asserted true. 

25 Soft SMMU 13 detects a miss when there is a fetch command and the 

address on address lines 21 does not result in a HIT and the WITHIN flag on 
a line 33 is asserted true. In this case, the desired page needs to be swapped 
in firom the external system memory and decrypted. If necessary (and only 
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for pages 15 from external RAM 45) a page is swapped out of main memory 
14 to make room for the new page. 

When soft SMMU 13 detects a fetch command, the address on address 
lines 21 results in a HIT and the WITHIN flag on a line 33 is not asserted 
5 true, then the memory transaction does not involve secure information. 

The last used page is determined by latching the EQO through EQN 
values. 

System processor 12 is the engine which performs necessary SMMXJ 
operations to allow encrypted data external to the integrated circuit to be 

10 utiUzed by system processor 12. In a preferred embodiment, processor 
performs encryption and decryption using two encrsrption engines to 
implement two separate decrj^tion algorithms (an encr3rption/decryption 
algorithm for data from external RAM 45 and a decryption algorithm for 
information from external ROM 145). Alternatively, as discussed above, 

1 5 system processor 12 can perform encrjrption and decryption using two 

separate software algorithms (a software encryption/decryption algorithm 
for data from external RAM 45 and a software decrj^tion algorithm for 
information from external ROM 145). 

For more information on operation of SMMU 13, see United States 

20 Patent Apphcation Serial No. 08/947,378, filed October 8, 1997, by Mark 
Leonard Buer and Gregory Clajrton Eslinger for SECURE MEMORY 
MANAGEMENT UNIT WHICH UTILIZES A SYSTEM PROCESSOR TO 
PERFORM PAGE SWAPPING, the subject matter of which is hereby 
incorporated by reference. 

25 Figure 4 is a simplified block diagram which shows data flow of 

secure information fi^om external system memory 45 into a data cache 
memory (pages 15 of main memory 14) for system processor 12 and shows 
data flow of secure information fi-om external ROM 46 into an instruction 
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cache memory (pages 115 of main memory 14) for system processor 12, A 
page of information from secure information 46 of external system memory 
45 is received by an SMMU function 47 of the integrated circuit. For 
example, the page of information contains secure data to be used by system 
5 processor 12. As discussed above, SMMU function 47 is implemented by soft 
SMMU hardware 13 and SMMU processes running on system processor 12. 

SMMU function 47 uses encr3rption engine 40 (or algorithms run by 
system processor 12) to decrypt the page of secure information, and places 
the decr3T)ted information within pages 15 of main memory 14. Processor 12 

10 can then access the decrypted information. 

A page of information from secure information 146 of external ROM 
145 is received by an SMMU function 147 of the integrated circxiit. For 
example, the page of information contains secure instructions to be executed 
by system processor 12. SMMU function 147 is implemented by soft SMMU 

15 hardware 13 and SMMU processes running on system processor 12. 

SMMU function 147 uses encrjrption engine 140 (or algorithms run by 
system processor 12) to decrypt the page of secure information, and places 
the decrynpted information within pages 115 of main memory 14. Processor 
12 can then access the decrypted information. 

20 Figure 5 shows usage of registers within soft SMMU 13 for data from 

external system memory 45. Limit registers 22 store page limits for secure 
information within secure information 46 of external system memory 45 
system. For example, limit registers 22 include a register which contains a 
lower limit to a section A and an upper limit to section A of secure 

25 information 46, as shown in Figure 5. Limits for additional segments also 
may be stored in limit registers 22, as illustrated by the register which 
contains a lower limit to a section B and the register which contains an 
upper limit to section B. 
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Cxirrent page information registers 51 identify addresses of pages 
cturrently in pages 15 of main memory 14. These pages, as needed, axe 
moved back and forth from secure information 46 of external system 
memory 45 system, as described above. Use of current page information 
registers 51 is described more fully above in the discussion of registers 24, 26 
and 28 shown in Figure 3. 

Figure 6 illustrates what happens when a page miss occurs for pages 
15. A page miss is initiated when a program coimter 82 for system 
processor 12 encoxmters an address which is not currently in main memory 
(SRAM) 14. Soft SMMU hardware 13 detects this as described above. Upon 
detection, soft SMMU 13 signals processor 12 on abort line 17. The SMMU 
process then takes control. If the requested address is within either the A or 
B limits (as set out in limit registers 22), the SMMU process claims the 
address and begins the process of fetching the page. Otherwise, the SMMU 
process will not claim the address and instead will allow a memory 
controller 85 to fetch the data. 

Once the SMMU process claims the address (that is soft SMMU 13 has 
asserted the abort signal on abort Une 17) a series of events occur as 
described above. The SMMU process writes a page back from pages 15, if 
necess£ay, £uid determines which of pages 15 to replace and computes the 
Page IV in registers 81, Page IV and seed 14 are specific to DES encryption. 
Page IV is used in coordination with seed IV to create a imique startup 
value for each 64 word block. The method for determining the page to swap 
is as follows: 

Next Page = (Last hit Page + 1) mod 4 
Last hit page is the page which was most recently hit. Hence the 
algorithm is cycHc in that it simply picks the next page in sequence. 
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The external page from secure pages 46 in external system memory 45 
is loaded into the input registers of encryption engine 40 and decryption 
begins. The output registers of encrj^jtion engine 40 are then moved into the 
appropriate page within pages 15 of main memory 14, The SMMU process 
5 will also update the missed page register which indicates which page was 
most recently swapped. Once the page has been loaded into pages 15, the 
SMMU process re-enables normal processing of processor 12. 

A write back of data from pages 15 occurs if two conditions are met: 
the external memory Hmit range is write back enabled and the page being 
10 swapped out has changed. Only external system memory 45 is write back 
enabled, not pages 15 of main memory 14. 

The foregoing discussion discloses and describes merely exemplary 
methods and embodiments of the present invention. As will be understood 
by those familiar with the art, the invention may be embodied in other 
15 specific forms without departing from the spirit or essential characteristics 
thereof. Accordingly, the disclosxire of the present invention is intended to 
be illustrative, but not limiting, of the scope of the invention, which is set 
forth in the following claims. 
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CLAIMS 

We Claim: 



1 1. A method by which an integrated circxiit accesses first encrj^ted 

2 data stored in an first external memory and accesses second encrypted data 

3 stored in an second external memory, the first external memory and the 

4 second external memory being external to the integrated circuit, the method 

5 comprising the following steps: 

6 (a) when accessing a first portion of the first encrypted data stored in 

7 the first external memory, performing the following substep: 

8 (a.l) using a first algorithm to decrypt the first portion of the 

9 first encrypted data; and, 

10 (b) when accessing a first portion of the second encrypted data stored 

11 in the second externgJ memory, performing the following substep: 

12 (b.l) using a second algorithm to decrypt the first portion of the 

13 second encrypted data, wherein the second algorithm is different than the 

14 first algorithm. 

1 2. A method as in claim 1 wherein: 

2 in step (b) the first portion of the second encrj^ted data includes 

3 instructions for execution by a processor; and, 

4 in step (a) the first portion of the first enoypted data includes data 

5 used during execution by the processor. . 

1 3. A method as in claim 1 additionally comprising the following step: 

2 (c) when returning the first portion of the first encrj^ted data to the 

3 first external memory, performing the following substep: 

4 (c.l) using the first algorithm to encrjrpt the first portion of the 

5 first encrypted data. 
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1 4. A method as in claim 1 additionally comprising the foDowing step: 

2 (c) upon reset of the integrated circxait, performing the following 

3 substep: 

4 (cl) generating a new decryption key for the first algorithm. 

1 5. A method as in claim 1 additionally comprising the following step: 

2 (c) upon start-up of the integrated circuit, performing the following 

3 substep: 

4 (c.l) generating a new decryption key for the first adgorithm, 

1 6. A method as in claim 1 wherein the first extemed memory is a 

2 random access memory and the second extemal memory is a read-only 

3 memory. 

1 7. A method by which an integrated circuit stores and retrieves first 

2 encr3rpted data stored in an first extemal memory, the first extemal 

3 memory being external to the integrated circuit, the method comprising the 

4 following steps: 

5 (a) upon start-up of the integrated circuit, performing the following 

6 substep: 

7 (a.l) generating a key for an encr3T)tion/decryption algorithm. 

8 Gb) when storing the first encrypted data to the first extemal memory, 

9 performing the following substep: 

10 (b.l) using the encrjTption/decryption algorithm the key to 

1 1 encrs^pt the first encrypted data. 

12 (c) when accessing a first portion of the first encrypted data stored in 

13 the first extemal memory, performing the following substep: 
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14 (c.l) using the encryption/decryption algoritliin and the key to 

15 decr3Tpt the first portion of the first encTTpted data. 

1 8. A method as in claim 7 additionally comprising the following step: 

2 (d) upon reset of the integrated circuit, performing the following 

3 substep: 

4 (d.l) generating a new key for the encryption/decryption 

5 algorithm 

1 9. An integrated circuit which accesses first encrypted data stored in 

2 an first external memory and accesses second encrypted data stored in an 

3 second external memory, the first external memory and the second external 

4 memory being external to the integrated circuit, the integrated circuit 

5 comprising: 

6 a first algorithm implementation means for, when accessing a first 

7 portion of the fij-st encrjrpted data stored in the first external memory, using 

8 a first algorithm to decrypt the first portion of the first encr3rpted data; and, 

9 a second algorithm implementation means for, when accessing a first 

10 portion of the second enaypted data stored in the second external memory, 

1 1 using a second algorithm to decrjrpt the first portion of the second encrypted 

12 data, wherein the second algorithm is different than the first algorithm. 

1 10. An integrated circuit as in claim 9 additionally comprising: 

2 a processor, wherein the first portion of the second encrypted data 

3 includes instructions for execution by the processor, and the first portion of 

4 the first encrsrpted data includes data used during execution by the 

5 processor. 
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1 11. An integrated circuit as in claim 9 wherein the first algorithm 

2 implementation means is additionally for, when returning the first portion 

3 of the first encr3T>ted data to the first external memory, using the first 

4 algorithm to encr3T)t the first portion of the first encrj^pted data. 

1 12, An integrated circuit as in claim 9 additionally comprising: 

2 generation means for generating a new dearyption key for the first 

3 algorithm upon reset of the integrated circuit. 

1 13. An integrated circuit as in claim 9 additionally comprising: 

2 generation means for generating a new decryption key for the first 

3 algorithm upon start-up of the integrated circxiit. 

1 14. An integrated circuit as in claim 9 wherein the first external 

2 memory is a random access memory and the second external memory is a 

3 read-only memory. 

1 15. An integrated circtiit which accesses first encrjrpted data stored in 

2 an first external memory, the first external memory being external to the 

3 integrated circuit, the integrated circuit comprising: 

4 a first algorithm implementation means for, when accessing a first 

5 portion of the first encrjrpted data stored in the first external memory, using 

6 a first algorithm to decrypt the first portion of the first encrypted data; 

7 a processor, wherein the first portion of the first encrypted data 

8 includes data used during execution by the processor; and, 

9 generation means for generating a key for the first algorithm upon 
1 0 start-up of the integrated circuit. 
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1 16. An integrated circuit as in claim 15 wherein the first algorithm 

2 implementatioh means is additionally for, when returning the first portion 

3 of the first encrypted data to the first external memory, using the first 

4 algorithm to encrypt the first portion of the first encrypted data. 

1 17. An integrated circuit as in claim 15 wherein the generation 

2 means is additionally for generating a new decrj^tion key for the first 

3 algorithm upon reset of the integrated circuit. 
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